What it does
Firejail uses Linux namespaces and seccomp-based controls to restrict application environments, with profiles for many desktop and server programs.
Firejail can give an application a restricted view of files and other kernel resources. Its documentation describes prefixing a command with the sandbox launcher and using existing profiles. Review the profile against the application's real file and network needs before adopting it. A restriction that blocks necessary work will invite broad exceptions, so keep the intended boundary understandable.
Strengths
- Profile-based application restrictions on Linux
Best for
- Linux users maintaining deliberate application sandboxes
Sources
- Firejail | security sandbox (Oct 26, 2026)